linux-kernel - Re: [PATCH] ipmi: fix hung processes in __get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200403125950.GQ2910@minyard.net>
Date:   Fri, 3 Apr 2020 07:59:50 -0500
From:   Corey Minyard <minyard@....org>
To:     Wen Yang <wenyang@...ux.alibaba.com>
Cc:     Arnd Bergmann <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        openipmi-developer@...ts.sourceforge.net,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ipmi: fix hung processes in __get_guid()

On Fri, Apr 03, 2020 at 05:04:08PM +0800, Wen Yang wrote:
> The wait_event() function is used to detect command completion.
> When send_guid_cmd() returns an error, smi_send() has not been
> called to send data. Therefore, wait_event() should not be used
> on the error path, otherwise it will cause the following warning:

Oops, yeah, that's a problem.  Thanks for the patch, I've put it into my
next tree.

I've requested a stable backport.

-corey

> 
> [ 1361.588808] systemd-udevd   D    0  1501   1436 0x00000004
> [ 1361.588813]  ffff883f4b1298c0 0000000000000000 ffff883f4b188000 ffff887f7e3d9f40
> [ 1361.677952]  ffff887f64bd4280 ffffc90037297a68 ffffffff8173ca3b ffffc90000000010
> [ 1361.767077]  00ffc90037297ad0 ffff887f7e3d9f40 0000000000000286 ffff883f4b188000
> [ 1361.856199] Call Trace:
> [ 1361.885578]  [<ffffffff8173ca3b>] ? __schedule+0x23b/0x780
> [ 1361.951406]  [<ffffffff8173cfb6>] schedule+0x36/0x80
> [ 1362.010979]  [<ffffffffa071f178>] get_guid+0x118/0x150 [ipmi_msghandler]
> [ 1362.091281]  [<ffffffff810d5350>] ? prepare_to_wait_event+0x100/0x100
> [ 1362.168533]  [<ffffffffa071f755>] ipmi_register_smi+0x405/0x940 [ipmi_msghandler]
> [ 1362.258337]  [<ffffffffa0230ae9>] try_smi_init+0x529/0x950 [ipmi_si]
> [ 1362.334521]  [<ffffffffa022f350>] ? std_irq_setup+0xd0/0xd0 [ipmi_si]
> [ 1362.411701]  [<ffffffffa0232bd2>] init_ipmi_si+0x492/0x9e0 [ipmi_si]
> [ 1362.487917]  [<ffffffffa0232740>] ? ipmi_pci_probe+0x280/0x280 [ipmi_si]
> [ 1362.568219]  [<ffffffff810021a0>] do_one_initcall+0x50/0x180
> [ 1362.636109]  [<ffffffff812231b2>] ? kmem_cache_alloc_trace+0x142/0x190
> [ 1362.714330]  [<ffffffff811b2ae1>] do_init_module+0x5f/0x200
> [ 1362.781208]  [<ffffffff81123ca8>] load_module+0x1898/0x1de0
> [ 1362.848069]  [<ffffffff811202e0>] ? __symbol_put+0x60/0x60
> [ 1362.913886]  [<ffffffff8130696b>] ? security_kernel_post_read_file+0x6b/0x80
> [ 1362.998514]  [<ffffffff81124465>] SYSC_finit_module+0xe5/0x120
> [ 1363.068463]  [<ffffffff81124465>] ? SYSC_finit_module+0xe5/0x120
> [ 1363.140513]  [<ffffffff811244be>] SyS_finit_module+0xe/0x10
> [ 1363.207364]  [<ffffffff81003c04>] do_syscall_64+0x74/0x180
> 
> Fixes: 50c812b2b951 ("[PATCH] ipmi: add full sysfs support")
> Signed-off-by: Wen Yang <wenyang@...ux.alibaba.com>
> Cc: Corey Minyard <minyard@....org>
> Cc: Arnd Bergmann <arnd@...db.de>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: openipmi-developer@...ts.sourceforge.net
> Cc: linux-kernel@...r.kernel.org
> ---
>  drivers/char/ipmi/ipmi_msghandler.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
> index 64ba16dcb681..c48d8f086382 100644
> --- a/drivers/char/ipmi/ipmi_msghandler.c
> +++ b/drivers/char/ipmi/ipmi_msghandler.c
> @@ -3193,8 +3193,8 @@ static void __get_guid(struct ipmi_smi *intf)
>  	if (rv)
>  		/* Send failed, no GUID available. */
>  		bmc->dyn_guid_set = 0;
> -
> -	wait_event(intf->waitq, bmc->dyn_guid_set != 2);
> +	else
> +		wait_event(intf->waitq, bmc->dyn_guid_set != 2);
>  
>  	/* dyn_guid_set makes the guid data available. */
>  	smp_rmb();
> -- 
> 2.23.0
>